Index and ingestion separation overview

Separate ingestion and indexing services in the Splunk Operator for Kubernetes.

Separation between ingestion and indexing services within the Splunk Operator for Kubernetes enables independent management of the ingestion service while maintaining seamless integration with the indexing service. This separation enables:

  • Independent scaling: Match resource allocation to ingestion or indexing workload.
  • Data durability: Off-load buffer management and retry logic to a durable message queue.
  • Operational clarity: Separate monitoring dashboards for ingestion throughput versus indexing latency.

Splunk support

These features require Splunk 10.2 or higher.

Important note

Warning: For customers deploying SmartBus on CMP, the Splunk Operator for Kubernetes (SOK) manages the configuration and lifecycle of the ingestor tier. The following SOK guide provides implementation details for setting up ingestion separation and integrating with existing indexers. This reference is primarily intended for CMP users leveraging SOK-managed ingestors.

Document variables

  • SPLUNK_IMAGE_VERSION: Splunk Enterprise Docker Image version

Common spec

Common spec values for all SOK custom resources are documented in the CustomResources reference topic.

App installation for Ingestor Cluster instances

Application installation for Ingestor Cluster instances uses local scope. If any application requires a Splunk restart, there is no automated way to detect the requirement and trigger the restart through the Splunk Operator.

To enforce a Splunk restart for each of the Ingestor Cluster pods, add or update the IngestorCluster CR annotations or labels and apply the new configuration. This triggers a rolling restart of Splunk pods for the Ingestor Cluster.